krab5[.]biz

Analysis of the domain krab5.biz, created on 21 February 2026 and currently marked offline, shows multiple indicators of malicious activity consistent with a generic phishing operation. The domain resolves to IP address 188.114.96.3, which belongs to AS13335 (Cloudflare, Inc.) and is geolocated in the United States. DNS is served by the Cloudflare nameservers drew.ns.cloudflare.com and tess.ns.cloudflare.com. No TLS certificate is presented, and an HTTP request returns a 403 status code, suggesting the site is deliberately restricting access, possibly after takedown.

The page title returned by the server is "Captcha," providing limited insight into the content but indicating the presence of a challenge page often used to impede automated analysis. The domain is listed on one security blocklist and has been explicitly blocked by the PhishDestroy mitigation service. VirusTotal reports that 2 of 95 scanning engines flagged the domain, reinforcing the suspicion of malicious intent. Gridinsoft assigns a trust score of 0 out of 100, the lowest possible rating.

Registration was performed through NICENIC INTERNATIONAL GROUP CO., LIMITED, a registrar that has hosted other abusive domains. While the exact phishing payload or targeted brand is not yet identified, the combination of recent creation, Cloudflare hosting, lack of SSL, HTTP 403 response, low trust scores, and detection by multiple security vendors establishes a high confidence that krab5.biz was used for phishing. Defenders should add krab5.biz to network and endpoint blocklists, monitor for any resurgence of the domain or related IP addresses, and ensure that URL filtering solutions reference both the blocklist entry and the PhishDestroy block. Continuous re‑evaluation of the domain’s status is recommended, as the offline indicator may change if the actors reactivate the site.